CVE-2026-72156
Description
In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() mpf_ops_parse_header() reads header_size from the bitstream at MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression *(buf + header_size - 1) reads one byte before the buffer start. Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET. The only real gap is the zero header_size case, which cannot be resolved by providing a larger buffer, so return -EINVAL.
How to fix
- Linux Linuxe45ec24d8e986d79a8e07f49a816c414ad283622, 0d3766fecd9b2db39a18b48021c15c522997ec25, a1baee24df72ec8fd1d6925c1d5162ffff4ee3bf, c9ef79e34bc1eac4fd59051e5c7b96a74e59d46f, 3da8eaf5469eda2353b72038d644fabddb848ce1, 43a1974da6bc7ce8f4d1dc1d03d56997428c29c3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 5f8d4a9008307e0bf210906948953386935d361c ≤ v < e45ec24d8e986d79a8e07f49a816c414ad283622, 5f8d4a9008307e0bf210906948953386935d361c ≤ v < 0d3766fecd9b2db39a18b48021c15c522997ec25, 5f8d4a9008307e0bf210906948953386935d361c ≤ v < a1baee24df72ec8fd1d6925c1d5162ffff4ee3bf, 5f8d4a9008307e0bf210906948953386935d361c ≤ v < c9ef79e34bc1eac4fd59051e5c7b96a74e59d46f, 5f8d4a9008307e0bf210906948953386935d361c ≤ v < 3da8eaf5469eda2353b72038d644fabddb848ce1, 5f8d4a9008307e0bf210906948953386935d361c ≤ v < 43a1974da6bc7ce8f4d1dc1d03d56997428c29c3, 6.0 | e45ec24d8e986d79a8e07f49a816c414ad283622, 0d3766fecd9b2db39a18b48021c15c522997ec25, a1baee24df72ec8fd1d6925c1d5162ffff4ee3bf, c9ef79e34bc1eac4fd59051e5c7b96a74e59d46f, 3da8eaf5469eda2353b72038d644fabddb848ce1, 43a1974da6bc7ce8f4d1dc1d03d56997428c29c3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.